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Amended Claim Schedule 

^ 

1 Claims 1-24 have been cancelled previously. 

1 25 . (Currently Amended) A method of issuing an electronic negotiable document 

2 (END) comprising: creating as data an END and storing this in a tamper-resistant docu- 

3 ment carrier, the document carrier containing a unique public-secret key pair for signing 

4 and verifying, [the secret key being generated within the document carrier], and a unique 

5 document carrier identifier; signing the unique document-carrier identifier, the END and 

6 an END identifier using the secret key of the public-secret key pair, and storing the result 

7 in the document carrier. 

1 26. (Previously Presented) A method according to Claim 25 of issuing an END, further 

2 comprising generating a time stamp representing the time of issue and storing this v^th 

3 the END in the tamper-resistant document carrier before the encryption step. 

1 27. (Previously Presented) A method according to Claim 25 of issuing an END, includ- 

2 ing the step of calculating a hash value of the END and/or the time stamp value and stor- 

3 ing this hash value instead of the full END in the tamper-resistant document carrier, be- 

4 fore the said encryption step. 
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1 28. (Previously Presented) A method according to Claim 25 of issuing an END, in 

2 which the document carrier identifier is a device number and the END identifier is a se- 

3 rial number. 

1 29. (Previously Presented) A method according to claim 25 of issuing an END, in which 

2 the END identifier is supplemented with data representing a water mark unique to the is- 

3 suer. 

1 30. (Previously Presented) A method according to claim 25 of issuing an END, com- 

2 prising the step of calculating a hash value of the data to be encrypted by said secret key, 

3 in place of the full data. 

1 31. (Previously Presented) A method according to claim 25 of issuing an END, in 

2 which the document carrier stores a negotiability status flag indicative of whether the 

3 END stored therein in negotiable or non-negotiable, and including the step of setting the 

4 flag to "negotiable" after the resuU of the encryption has been stored in the document car- 

5 rier. 

1 32. (Previously Presented) A method according to claim 25 of issuing an END, in 

2 which the document carrier includes a counter for counting a serial number, indicative of 

3 the number of times that the END has been negotiated since issue, and comprising the 

4 step of setting the counter to zero after the result of the encryption has been stored in the 

5 docxmient carrier. 

1 33. (Previously Presented) A tamper-resistant document carrier adapted to store an END 

2 in accordance with the method of claim 25, comprising read only software for controlling 

3 the steps of storing the END, encrypting the END and other data with the pre-stored se- 

4 cret key, and storing the result in a memory. 
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1 34. (Previously Presented) A document carrier according to Claim 33, in which the 

2 memory includes a negotiability status flag capable of being set either to "negotiable" or 

3 to "non-negotiable*. 

1 35. (Previously Presented) A document carrier according to Claim 33, in which the 

2 memory includes a counter for storing a serial number representative of the number of 

3 times the END has been negotiated. 

1 36. (Currently Amended) A method of negotiating an END between a seller and a buyer 

2 each possessing a tamper-resistant document carrier having its ovm public-secret key 

3 pair, in which the END is stored in the seller's document carrier in the form of END data, 

4 and the signature generated by the secret signing-key of a document carrier of the issuer 

5 of the END, together with a negotiability status flag indicative of whether the END is 

6 currently negotiable from the document carrier on which it is stored, comprising estab- 

7 lishing mutual recognition [and verification] between the seller and buyer using one or 

8 more predetermined protocols between the respective document carriers; verifying in the 

9 seller's dociunent carrier that the negotiability status flag is "negotiable" and aborting the 

10 negotiation if not; sending the public encryption key of the buyer's docimient carrier to 

11 the seller's document carrier, and using it to encrypt the message comprising the END 

12 together with the negotiability status flag; sending that encrypted message to the buyer; 

13 decrypting that message using the buyer's secret decryption key, and setting the negotia- 

14 bility status flag for that END of the buyer's and seller's document carriers respectively to 

15 ["non-negotiable"] "negotiable" and ["negotiable"] " non-negotiable" . 



1 37. (Currently Amended) A method of negotiating an END between a seller and, a 

2 buyer each possessing a tamper-resistant document carrier having its own public-secret 

3 key pair, in which the END is stored in the seller's document carrier in the form of END 

4 data, and the signature generated by the secret signing key of a document carrier of the 
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issuer of the END, together with a serial number counter indicative of the number of 
times that the END has been negotiated since issue, comprising estabUshing mutual rec- 
ognition [and verification] between seller and buyer using one or more predetermined 
protocols between the respective document carriers; verifying in the sellers document 
carrier that the END, if it has been stored previously in that document carrier, has a dif- 
ferent counter value this time and is therefore negotiable; sending the public encryption 
key of the buyer's document carrier to the seller's document carrier, and using it to en- 
crypt the message comprising the END together with the counter; sending that encrypted 
message to the buyer; decrypting that message using the buyer's secret decryption key, 
and incrementing the counter by one. 

38. (Previously Presented) A method according to Claim 36, in which each document 
carrier is installed originally with a certificate comprising a digital signature of its unique 
identifier and of its public key. 

39. (Previously Presented) A method according to Claim 37, in which each document 
carrier is in- stalled originally with a certificate comprising a digital signature of its 
unique identifier and of its public key. 

40. (Previously Presented) A method according to Claim 38, in which the certificate 
unique to the document carrier on which the END was originally issued is stored with the 
END in the seller's document carrier. 

41 . (Previously Presented) A method according to Claim 39, in which the certificate 
unique to the document carrier on which the END was originally issued is stored with the 
END in the seller's document carrier. 
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1 42. (Previously Presented) A method according to Claim 38, in which the certificate of 

2 the buyer^s document carrier is sent to the seller's document carrier in which it is authen- 

3 ticated and the negotiation is aborted if authentication fails. 

1 43. (Previously Presented) A method according to Claim 39, in which the certificate of 

2 the buyer's document carrier is sent to the seller's document carrier in which it is authen- 

3 ticated and the negotiation is aborted if authentication fails. 

1 44. (Previously Presented) A method according to Claim 36, in which the buyer's 

2 document carrier, after decrypting the message using its secret key, verifies the signature 

3 of the issuer on the END, and informs the issuer in the event that authentication fails. 

1 45 . (Previously Presented) A method according to Claim 37, in which the buyer*s 

2 document carrier, after decrypting the message using its secret key, verifies the signature 

3 of the issuer on the END, and informs the issuer in the event that authentication fails. 

1 46. (Previously Presented) A method according to Claim 25, of issuing an END on a 

2 document-carrier followed by a method of negotiating an END between a seller and a 

3 buyer each possessing a tamper-resistant document carrier having its own public-secret 

4 key pair, in which the END is stored in the seller's document carrier in the form of END 

5 data, and the signature generated by the secret signing-key of a document carrier of the 

6 issuer of the END, together with a negotiability status flag indicative of whether the END 

7 is currently negotiable from the document carrier on which it is stored, comprising estab- 

8 lishing mutual recognition between the seller and buyer using a predetermined protocol 

9 between the respective document carriers; verifying in the seller's document carrier that 

10 the negotiability status flag is "negotiable" and aborting the negotiation if not; sending 

11 the public encryption key of the buyer's document carrier to the seller's document carrier, 

12 and using it to encrypt the message comprising the END together with the negotiability 

13 status flag; sending that encrypted message to the buyer; decrypting that message using 
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14 the buyer's secret decryption key, and setting the negotiability status flag for that END of 

15 the buyer's and seller's document carriers respectively to "non-negotiable" and "negotia- 
te ble". 

1 47. (Previously Presented) A method according to Claim 25, of issuing an END on a 

2 document-carrier followed by a method of negotiating an END between a seller and a 

3 buyer each possessing a tamper-resistant document carrier having its own public secret 

4 key pair, in which the END is stored in the seller's document carrier in the form of END 

5 data, and the signature generated by the secret signing key of a document carrier of the 

6 issuer of the END, together with a serial number counter indicative of the number of 

7 times that the END has been negotiated since issue, comprising establishing mutual rec- 

8 ognition between seller and buyer using a predetermined protocol between their respec- 

9 tive document carriers; verifying in the seller's document carrier that the END, if it has 

10 been stored, previously in that document carrier, has a different counter value this time 

1 1 and is therefore negotiable, but aborting the negotiation if it is not negotiable; sending the 

12 public encryption key of the buyer's document carrier to the seller's document carrier, and 

13 using it to encrypt the message comprising the END together with the counter; sending 

14 that encrypted message to the buyer; decrypting that message using the buyer's secret de- 
ls cryption key, and incrementing the counter by one. 

1 48. (Previously Presented) A method according to Claim 26, of issuing and END on a 

2 document- carrier followed by a method of negotiating an END between a seller and a 

3 buyer each possessing a tamper-resistant document carrier having its own public-secret 

4 key pair, in which the END is stored in the seller' s docxmient carrier in the form of END 

5 data, and the signature generated by the secret signing-key of a document carrier of the 

6 issuer of the END, together with a negotiability status flag indicative of whether the END 

7 is currently negotiable from the document carrier on which it is stored, comprising estab- 

8 lishing mutual recognition between the seller and buyer using a predetermined protocol 

9 between the respective document carriers; verifying in the seller' s document carrier 'that 
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10 the negotiability status flag is "negotiable" and aborting the negotiation if not; sending 

1 1 the public encryption key of the buyer's document carrier to the seller's document carrier, 

12 and using it to encrypt the message comprising the END together with the negotiability 

13 status flag; sending that encrypted message to the buyer; decrypting that message using 

14 the buyer's secret decryption key, and setting the negotiability status flag for that END of 

15 the buyer's and seller's document carriers respectively to "non-negotiable" and "negotia- 

16 ble". 

1 49. (Previously Presented) A method according to Claim 26, of issuing an END on a 

2 document-carrier followed by a method of negotiating an END between a seller and a 

3 buyer each possessing a tamper-resistant document carrier having its own public secret 

4 key pair, in which the END is stored in the seller's document carrier in the form of END 

5 data, and the signature generated by the secret signing key of a document carrier of the 

6 issuer of the END, together with a serial number counter indicative of the number of 

7 times that the END has been negotiated since issue, comprising establishing mutual rec- 

8 ognition between seller and buyer using a predetermined protocol between their respec- 

9 tive document carriers; verifying in the seller's document carrier that the END, if it has 

10 been stored previously in that document carrier, has a different counter value this time 

1 1 and is therefore negotiable, but aborting the negotiation if it is not negotiable; sending the 

12 public encryption key of the buyer's document carrier to the seller's document carrier, and 

13 using it to encrypt the message comprising the END together with the counter; sending 

14 that encrypted message to the buyer; decrypting that message using the buyer's secret de- 
ls cryption key, and incrementing the counter by one. 

1 50. (Currently Amended) A method according to Claim 48, in which the buyer's docu- 

2 ment carrier, after decrypting the message with its secret key, verifies that the END is 

3 still valid by taking its time stamp, and, if it has expired, informs the issuer of this, and 

4 aborts the negotiation before [implementing] incrementing the counter or setting the ne- 

5 gotiation status flag. 
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1 51. (Currently Amended) A method according to Claim 49, in which the buyer's docu- 

2 ment carrier, after decrypting the message with its secret key, verifies that the END is 

3 still valid by taking its time stamp, and, if it has expired, informs the issuer of this, and 

4 aborts the negotiation before [implementing] incrementing the counter or setting the ne- 

5 gotiation status flag. 

1 52. (Previously Presented) A method according to Claim 36, including recovering the 

2 negotiation of an END which has previously broken dovm, by providing the buyer's 

3 document-carrier with the necessary secret key which has been reproduced by the issuer 

4 or by a trusted third party. 

1 53. (Previously Presented) A method according to Claim 37, including recovering the 

2 negotiation of an END which has previously broken down, by providing the buyer's 

3 document-carrier with the necessary secret key which has been reproduced by the issuer 

4 or by a trusted third party. 

1 54. (Previously Presented) A method according to Claim 36, including recovering an 

2 END lost from a primary document-carrier, by activating a back-up document-carrier 

3 "which has previously been provided with back-up data reproduced from the primary 

4 document-carrier. 

1 55. (Previously Presented) A method according to Claim 37, including recovering an 

2 END lost from a primary document-carrier, by activating a back-up document-carrier 

3 which has previously been provided with back-up data reproduced from the primary 

4 document-carrier. 

1 56. (Previously Presented) A method according to Claim 52, comprising inhibiting the 

2 recovery until the expiry of the predetermined period of validity of the END. 



9 



PATENTS 
105005-0044C1 

1 57. (Previously Presented) A method according to Claim 53, comprising inhibiting the 

2 recovery until the expiry of the predetermined period of validity of the END. 

1 58. (Previously Presented) A method according to Claim 54, comprising inhibiting the 

2 recovery imtil the expiry of the predetermined period of validity of the END. 

1 59. (Previously Presented) A method according to Claim 55, comprising inhibiting the 

2 recovery until the expiry of the predetermined period of validity of the END. 

1 60. (Currently Amended) A method of negotiating an END, sold by a seller to a buyer, 

2 in which the buyer splits the END electronically into two or more parts and then negoti- 

3 ates those parts separately to one or more further buyers [, wherein the total value repre- 

4 sented by all parts remains the same as the value of the END]. 

1 61 . (Previously Presented) A method according to Claim 60, in which each part is sub- 

2 jected to the digital signature of the said buyer's document carrier which effects the split- 

3 ting. 
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